Privacy Policy

1. Information We Collect

When you create an account, we collect:

• First and last name
• Email address
• Country of residence
• Password (stored as a bcrypt hash — we never store plain text passwords)
• Login timestamps and login count

When you use the Service, we also collect:

• Project names and Figma file IDs
• JSON layout data exported from your Figma designs
• Subscription status and payment records (via Lemon Squeezy)

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service
• Authenticate your account and maintain your session
• Store and sync your Figma-to-Roblox project data
• Process payments and manage your subscription
• Send important account notifications (no marketing without consent)
• Improve the Service based on usage patterns

3. Data Storage

Your data is stored on MongoDB Atlas (cloud database hosted by MongoDB Inc.) with servers located in the United States. Session data is also stored in MongoDB. We use Render.com to host the application server.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

• Lemon Squeezy — payment processing (they handle billing securely)
• MongoDB Atlas — database hosting
• Render.com — application hosting

These providers have their own privacy policies and we encourage you to review them.

5. Cookies

We use session cookies to keep you logged in. These are strictly necessary for the Service to function and do not track you across other websites. We do not use advertising or analytics cookies. Session cookies expire after 7 days of inactivity.

6. Your Rights

You have the right to:

• Access — request a copy of the data we hold about you
• Correction — update your account details via the profile page
• Deletion — request deletion of your account and all associated data
• Portability — request your project data in JSON format

To exercise these rights, contact us through the dashboard or GitHub.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days. Project data (JSON layouts) may be retained in anonymized form for service improvement.

8. Children's Privacy

Bloxig is a developer tool intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

9. Security

We take security seriously. Passwords are hashed using bcrypt with salt rounds of 12. API access requires JWT authentication. Sessions are stored server-side in MongoDB with HTTP-only cookies. We use HTTPS in production via Render's SSL certificates.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a dashboard notice. The "last updated" date at the top of this page reflects the most recent revision.

11. Contact

For privacy-related questions or data deletion requests, please contact us through the dashboard or via our GitHub repository at github.com/ethruz/bloxig.